AppSec Delivery PM: Security Risk & SDLC

Bank of America; Denver (CO); On-site; USD 135,000 - 217,000; Full time

Benefits offered by this job

Benefits eligible

Job summary

Bank of America in Denver, CO seeks a Product Manager – Tech Delivery to partner with BISO and CIOs to ensure secure software delivery across the SDLC. You will analyze, validate, and adjudicate findings, guiding risk-based security decisions across enterprise systems.

The role requires deep application security expertise, collaboration with development teams, architects, and risk partners, and the ability to communicate complex findings to technical and non-technical stakeholders.

Qualifications

• 10+ years of Information Security, Application Security, Secure Software Development, or Technology Risk Management experience.
• 5+ years of experience in Application Security, Secure Software Development, Vulnerability Management, Security Architecture, or Information Security Risk Management.
• Strong experience performing source code analysis, vulnerability validation, application security assessments, and security testing.
• Subject matter expertise in Application Security, Secure SDLC, Vulnerability Management, Threat Modeling, Secure Coding Practices, OWASP Top 10, and Common Weakness Enumerations (CWE).

Responsibilities

• Possess a strong application security background with extensive knowledge of software development methodologies, SDLC processes, software architecture, and secure coding practices.
• Serve as the primary technical reviewer and adjudicator for application security findings generated through Checkmarx One and other approved security testing technologies.
• Review, analyze, validate, and disposition application security findings using evidence-based technical analysis.
• Independently validate vulnerability findings rather than relying solely on automated scanner results, developer rationale, AI-generated recommendations, or previous dispositions.
• Analyze source code, application architecture, APIs, business logic, trust boundaries, data flows, and software design patterns to assess vulnerability validity and security impact.
• Evaluate exploitability, reachability, attack paths, compensating controls, exposure conditions, and real-world security risk.
• Review and validate developer-submitted adjudication requests, including Proposed Not Exploitable determinations and supporting evidence packages.

Skills

Influence

Solution Delivery Process

Stakeholder Management

Technical Strategy

Development Agile Practices

Analytical Thinking

Collaboration

Result Orientation

Risk Management

Business Acumen

Business Case Analysis

Data Management

Education

Bachelor’s and/or Master’s degree in Computer Science, Information Technology, Cybersecurity, Software Engineering, or a related field

Tools

Checkmarx One

Job description

Bank of America in Denver, CO seeks a Product Manager – Tech Delivery to partner with BISO and CIOs to ensure secure software delivery across the SDLC. You will analyze, validate, and adjudicate findings, guiding risk-based security decisions across enterprise systems.

The role requires deep application security expertise, collaboration with development teams, architects, and risk partners, and the ability to communicate complex findings to technical and non-technical stakeholders.